Privacy Policy

Effective October 17, 2026

MustStash is operated by 529 Development LLC, doing business as MustStash ("we", "us"). MustStash is an app for couples and households to share notes, tasks, a calendar and a budget. This policy explains what we collect, why, who we share it with, and the choices you have. It applies to the MustStash web app at muststashapp.com and our mobile apps.

The short version: we collect what we need to run the app for your household. We don't sell your data, we don't show ads, and we don't use your financial data for anything other than showing it back to you and your household.

What we collect

• Account information: your name, email address, and the household you belong to. We sign you in with one-time codes sent to your email; we don't store passwords.
• Content you add: notes, tasks, calendar items, pages, checklists, budget categories and targets, manually entered transactions, and any photos or documents you upload.
• Bank account data, if you choose to link a bank: the institution name, account name and type, the last four digits of the account number, and transactions (description, amount, date and status). Bank linking is optional; the app works without it.
• Subscription status: whether your household's plan is active, and when it renews. Payments are handled by Stripe, Apple or Google; we never see or store your full card number.
• Device information: a push notification token if you turn on notifications in the mobile app, and basic technical logs (such as error messages and request times) that our hosting providers record to keep the service running.

We do not use advertising trackers or third-party analytics.

How bank linking works

We use Stripe Financial Connections to connect your bank. You sign in to your bank inside Stripe's secure window; we never see or store your bank username or password. You choose which accounts to share, and Stripe gives us read-only access to their transactions and account details. We cannot move money or make payments from linked accounts.

Stripe's handling of the data it collects is described in the Stripe Privacy Policy. You can disconnect a bank in the app at any time, which stops further syncing; you can also revoke access with your bank.

How we use your information

• To provide the app: syncing your household's notes, tasks, calendar and budget, importing linked transactions into your inbox, and suggesting categories for them.
• To send messages you rely on: sign-in codes, reminders and notifications you've turned on, and important notices about your account or this policy.
• To keep the service secure and working: preventing abuse, fixing bugs and responding to support requests.
• To comply with the law.

We do not sell your personal information, share it for cross-context behavioral advertising, or use your financial data for lending, credit or marketing decisions.

Sharing within your household

MustStash is built for sharing. Everything you add to a household, including linked bank accounts and their transactions, is visible to the other members of that household. Only link accounts and add content you're comfortable sharing with them. If you leave a household, content you added stays with that household.

Service providers

We share information only with providers that help us run MustStash, under agreements that limit how they can use it:

• Convex: database and backend hosting.
• Cloudflare: web hosting and content delivery.
• Stripe: bank linking (Financial Connections) and web subscription payments.
• RevenueCat, Apple and Google: in-app subscriptions on mobile.
• AgentMail: sending sign-in and account emails.
• Expo: delivering push notifications to the mobile app.

We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or sale of the business (in which case this policy continues to apply to your information).

Retention and deletion

We keep your information while your account is active. You can delete notes, tasks, transactions and other content in the app at any time, and disconnect linked banks. To delete your account and your personal information, email us at the address below; we'll complete the request within 30 days, except where we must keep certain records (such as payment records) by law. Backups are overwritten on a rolling basis.

Security

Data is encrypted in transit (HTTPS) and at rest by our hosting providers. Access to your household's data is limited to its members and checked on every request. No system is perfectly secure, but we work to protect your information and will notify you of a breach as required by law.

Your rights

You can access, correct, export or delete your personal information, and opt out of non-essential notifications in the app's settings. Depending on where you live (for example, California), you may have additional rights under local law; we will honor them and won't treat you differently for using them. To make a request, email us.

Children

MustStash is not intended for children under 13, and we don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it.

Changes to this policy

If we change this policy, we'll update the date above. If the changes are significant, such as using your data in a new way, we'll tell you in the app or by email before they take effect.

Contact

Questions or requests: [email protected]